4 ms·

It would seem prudent for devices that include WAN remote management features to include some kind of prominent 'manual/local mode' switch to silently disable r

It would seem prudent for devices that include WAN remote management features to include some kind of prominent 'manual/local mode' switch to silently disable remote management where practical, for cases where victims might face retribution for disabling it, or simply if an account has been compromised.

dpwm 8y ago
Unfortunately this doesn't seem to be a consideration to manufacturers. Even if they are meant to work offline, this is going to be the least-tested path. IIRC there have been cases with certain internet-enabled thermostats failing to do the core thing (regulate the temperature) because they couldn't phone home. The solution if you want something without such surprises is to work with open or semi-open devices (e.g. can be controlled by your own home automation server) that don't just magically connect to the internet and just work. The problem with this is that using your own home automation server requires a degree of knowledge not readily found in the population at large, and can in many cases give even more control to the partner who installed it over an internet-of-things solution. It does seem to me that a lot of home automation devices are marketed as being about being able control things that were operated by a switch by a remote control that can work from another country, rather than about better regulating light or heat or security. Perhaps some people see such tools as they are marketed as a way to gain power over others.
olefoo 8y ago
By definition, disabling remote management will be visible to the attacker. But a recording hub that can prove an attacker did things would be possible to deploy undetectably. Digital locksmiths who can update a home network and cloud footprint are now a feature of middle class life; most divorce lawyers know one or two. And don't forget the cars. You'd be surprised at how small a gps tracker can be. And cars with on-board compute power can do funky things like use the backup cameras to watch the surrounding area...
- Eridrus 8y ago
  The recording hub idea is really interesting. I appreciate the constructive idea about what device makers could actually do to help, rather than just bringing our hands. If you have any others, I'd be interested to hear what you think would help. Though now that I think about it a bit more, it treads a fine line between being a back door for monitoring activity, though maybe you could log something super limited like when an account initiated a remote action, without recording anything about what the action was.
- WiseWeasel 8y ago
  For a thermostat, it would likely not be immediately visible to the attacker unless they cross-reference their smart energy meter readings. It might possibly escape detection for lights, doorbells and music depending on the degree of video/audio surveillance.
  - jpindar 8y ago
    Sure it would be. If they turn up the desired temperature and the measured temperature doesn't go up, they know the thermostat is disconnected.
    - LeifCarrotson 8y ago
      The key part of the original post is to SILENTLY disable the remote interface. This only leaks if there are two devices (a thermostat and temperature sensor) that don't know about each other or the other's secret offline status. With a doorbell, the assumption is that the app would be made to show 'ringing doorbell' when the doorbell is actually offline and silent - not as presently implemented where the Internet of Shit app doesn't have any fault handling and simply HTTP GETs {"doorbell":"ring"} and discards the response. Same for the thermostat, as for the Android privacy APKs that show bogus location data, white noise from the mic, bogus contacts, or the inside of a lens cover from the camera to apps that request those permissions needlessly.
cat199 8y ago
but what about the rights of the undisclosed backdoors??

dpwm 8y ago

Unfortunately this doesn't seem to be a consideration to manufacturers. Even if they are meant to work offline, this is going to be the least-tested path. IIRC there have been cases with certain internet-enabled thermostats failing to do the core thing (regulate the temperature) because they couldn't phone home. The solution if you want something without such surprises is to work with open or semi-open devices (e.g. can be controlled by your own home automation server) that don't just magically connect to the internet and just work. The problem with this is that using your own home automation server requires a degree of knowledge not readily found in the population at large, and can in many cases give even more control to the partner who installed it over an internet-of-things solution. It does seem to me that a lot of home automation devices are marketed as being about being able control things that were operated by a switch by a remote control that can work from another country, rather than about better regulating light or heat or security. Perhaps some people see such tools as they are marketed as a way to gain power over others.

olefoo 8y ago

By definition, disabling remote management will be visible to the attacker. But a recording hub that can prove an attacker did things would be possible to deploy undetectably. Digital locksmiths who can update a home network and cloud footprint are now a feature of middle class life; most divorce lawyers know one or two. And don't forget the cars. You'd be surprised at how small a gps tracker can be. And cars with on-board compute power can do funky things like use the backup cameras to watch the surrounding area...

Eridrus 8y ago
The recording hub idea is really interesting. I appreciate the constructive idea about what device makers could actually do to help, rather than just bringing our hands. If you have any others, I'd be interested to hear what you think would help. Though now that I think about it a bit more, it treads a fine line between being a back door for monitoring activity, though maybe you could log something super limited like when an account initiated a remote action, without recording anything about what the action was.
WiseWeasel 8y ago
For a thermostat, it would likely not be immediately visible to the attacker unless they cross-reference their smart energy meter readings. It might possibly escape detection for lights, doorbells and music depending on the degree of video/audio surveillance.
- jpindar 8y ago
  Sure it would be. If they turn up the desired temperature and the measured temperature doesn't go up, they know the thermostat is disconnected.
  - LeifCarrotson 8y ago
    The key part of the original post is to SILENTLY disable the remote interface. This only leaks if there are two devices (a thermostat and temperature sensor) that don't know about each other or the other's secret offline status. With a doorbell, the assumption is that the app would be made to show 'ringing doorbell' when the doorbell is actually offline and silent - not as presently implemented where the Internet of Shit app doesn't have any fault handling and simply HTTP GETs {"doorbell":"ring"} and discards the response. Same for the thermostat, as for the Android privacy APKs that show bogus location data, white noise from the mic, bogus contacts, or the inside of a lens cover from the camera to apps that request those permissions needlessly.

cat199 8y ago

but what about the rights of the undisclosed backdoors??